@open-mercato/core 0.10.1-develop.7833.1.d6cbf0e3ab → 0.10.1-develop.7841.1.af87ac614d

package/dist/modules/staff/lib/time-tracking-ui/NoProjectAccess.js

@@ -9,32 +9,50 @@ import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { apiCallOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
 import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { useProjectAccessScope } from "./projectAccessScope.js";
 const MY_WORK_HREF = "/backend/staff/time-tracking";
 const ACCESS_REQUEST_ENDPOINT = "/api/staff/timesheets/access-requests";
 const ACCESS_REQUEST_CONTEXT_ID = "staff.time_tracking.access_request";
-function AccessRequestButton({
+function AccessRequestButton(props) {
+  const { scopeKey, isCurrentScope } = useProjectAccessScope(props.timeProjectId, props.resolvedScope);
+  return /* @__PURE__ */ jsx(ScopedAccessRequestButton, { ...props, isCurrentScope }, scopeKey);
+}
+function ScopedAccessRequestButton({
   timeProjectId,
   label,
   sentLabel,
-  variant = "outline"
+  variant = "outline",
+  isCurrentScope
 }) {
   const t = useT();
   const [submitting, setSubmitting] = React.useState(false);
   const [sent, setSent] = React.useState(false);
+  const mounted = React.useRef(true);
+  React.useEffect(() => {
+    mounted.current = true;
+    return () => {
+      mounted.current = false;
+    };
+  }, []);
   const { runMutation, retryLastMutation } = useGuardedMutation({
     contextId: ACCESS_REQUEST_CONTEXT_ID,
     blockedMessage: t("ui.forms.flash.saveBlocked", "Save blocked by validation")
   });
   const requestAccess = React.useCallback(async () => {
+    const isCurrent = () => mounted.current && isCurrentScope();
+    if (!isCurrent()) return;
     const payload = timeProjectId ? { timeProjectId } : {};
     setSubmitting(true);
     try {
       await runMutation({
-        operation: () => apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify(payload)
-        }),
+        operation: () => {
+          if (!isCurrent()) throw new Error("[internal] Access request scope changed");
+          return apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(payload)
+          });
+        },
         context: {
           formId: ACCESS_REQUEST_CONTEXT_ID,
           resourceKind: "staff.timesheets.access_request",
@@ -42,6 +60,7 @@ function AccessRequestButton({
         },
         mutationPayload: payload
       });
+      if (!isCurrent()) return;
       setSent(true);
       flash(
         t(
@@ -51,20 +70,21 @@ function AccessRequestButton({
         "success"
       );
     } catch {
+      if (!isCurrent()) return;
       flash(
         t("staff.time_tracking.access.request.error", "Could not send the access request."),
         "error"
       );
     } finally {
-      setSubmitting(false);
+      if (isCurrent()) setSubmitting(false);
     }
-  }, [retryLastMutation, runMutation, t, timeProjectId]);
+  }, [isCurrentScope, retryLastMutation, runMutation, t, timeProjectId]);
   return /* @__PURE__ */ jsxs(Button, { type: "button", variant, onClick: requestAccess, disabled: submitting || sent, children: [
     /* @__PURE__ */ jsx(MessageSquare, { className: "size-4", "aria-hidden": "true" }),
     sent ? sentLabel : label
   ] });
 }
-function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }) {
+function NoProjectAccess({ timeProjectId, resolvedScope, myWorkHref = MY_WORK_HREF }) {
   const t = useT();
   return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
     EmptyState,
@@ -86,6 +106,7 @@ function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }) {
           AccessRequestButton,
           {
             timeProjectId,
+            resolvedScope,
             label: t("staff.time_tracking.access.denied.request", "Request access"),
             sentLabel: t("staff.time_tracking.access.request.sent", "Request sent")
           }

package/dist/modules/staff/lib/time-tracking-ui/NoProjectAccess.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/NoProjectAccess.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { ArrowLeft, FolderOpen, MessageSquare, ShieldAlert } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { EmptyState } from '@open-mercato/ui/primitives/empty-state'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\nexport const MY_WORK_HREF = '/backend/staff/time-tracking'\nexport const ACCESS_REQUEST_ENDPOINT = '/api/staff/timesheets/access-requests'\nconst ACCESS_REQUEST_CONTEXT_ID = 'staff.time_tracking.access_request'\n\nexport type AccessRequestButtonProps = {\n  /**\n   * Sent with the request so a Team Leader lands on the right project team\n   * drawer. It is never rendered \u2014 screen 17 note 1 forbids confirming that the\n   * project exists to a user who has no right to it.\n   */\n  timeProjectId?: string | null\n  label: string\n  sentLabel: string\n  variant?: 'default' | 'outline'\n}\n\nexport function AccessRequestButton({\n  timeProjectId,\n  label,\n  sentLabel,\n  variant = 'outline',\n}: AccessRequestButtonProps) {\n  const t = useT()\n  const [submitting, setSubmitting] = React.useState(false)\n  const [sent, setSent] = React.useState(false)\n  const { runMutation, retryLastMutation } = useGuardedMutation<Record<string, unknown>>({\n    contextId: ACCESS_REQUEST_CONTEXT_ID,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const requestAccess = React.useCallback(async () => {\n    const payload = timeProjectId ? { timeProjectId } : {}\n    setSubmitting(true)\n    try {\n      await runMutation({\n        operation: () =>\n          apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify(payload),\n          }),\n        context: {\n          formId: ACCESS_REQUEST_CONTEXT_ID,\n          resourceKind: 'staff.timesheets.access_request',\n          retryLastMutation,\n        },\n        mutationPayload: payload,\n      })\n      setSent(true)\n      flash(\n        t(\n          'staff.time_tracking.access.request.success',\n          'Your request has been sent to the Team Leaders.',\n        ),\n        'success',\n      )\n    } catch {\n      flash(\n        t('staff.time_tracking.access.request.error', 'Could not send the access request.'),\n        'error',\n      )\n    } finally {\n      setSubmitting(false)\n    }\n  }, [retryLastMutation, runMutation, t, timeProjectId])\n\n  return (\n    <Button type=\"button\" variant={variant} onClick={requestAccess} disabled={submitting || sent}>\n      <MessageSquare className=\"size-4\" aria-hidden=\"true\" />\n      {sent ? sentLabel : label}\n    </Button>\n  )\n}\n\nexport type NoProjectAccessProps = {\n  timeProjectId?: string | null\n  /** Where the \"Back to My work\" action returns to. */\n  myWorkHref?: string\n}\n\n/**\n * Screen 17 \u2014 a project-scoped route the caller may not open. The copy names\n * neither the customer nor the project (note 1) and covers both \"never had\n * access\" and \"access was revoked\" (note 2); navigation stays untouched because\n * the caller still has other projects (note 3).\n */\nexport function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {\n  const t = useT()\n  return (\n    <Page>\n      <PageBody>\n        <EmptyState\n          variant=\"subtle\"\n          size=\"lg\"\n          icon={<ShieldAlert className=\"size-6\" aria-hidden=\"true\" />}\n          title={t('staff.time_tracking.access.denied.title', 'You do not have access to this project')}\n          description={t(\n            'staff.time_tracking.access.denied.description',\n            'Project access is granted one project at a time by a Team Leader. If you had access before, it may have been revoked \u2014 your earlier time entries stay saved.',\n          )}\n          actions={\n            <div className=\"flex flex-wrap items-center justify-center gap-2\">\n              <Button type=\"button\" variant=\"default\" asChild>\n                <a href={myWorkHref}>\n                  <ArrowLeft className=\"size-4\" aria-hidden=\"true\" />\n                  {t('staff.time_tracking.access.denied.back', 'Back to My work')}\n                </a>\n              </Button>\n              <AccessRequestButton\n                timeProjectId={timeProjectId}\n                label={t('staff.time_tracking.access.denied.request', 'Request access')}\n                sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n              />\n            </div>\n          }\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\n/**\n * Screen 2 \u2014 the caller has no project assignments at all. Rendered inside the\n * host page (which keeps its own header), so it stays a bare empty state.\n */\nexport function NoTimeProjectAssignments() {\n  const t = useT()\n  return (\n    <EmptyState\n      variant=\"subtle\"\n      size=\"lg\"\n      icon={<FolderOpen className=\"size-6\" aria-hidden=\"true\" />}\n      title={t('staff.time_tracking.access.empty.title', 'You have no projects assigned yet')}\n      description={t(\n        'staff.time_tracking.access.empty.description',\n        'A Team Leader grants project access. Once you are added to a project it shows up here right away \u2014 no need to log in again.',\n      )}\n      actions={\n        <AccessRequestButton\n          variant=\"default\"\n          label={t('staff.time_tracking.access.empty.request', 'Ask a Team Leader for access')}\n          sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n        />\n      }\n    />\n  )\n}\n\nexport default NoProjectAccess\n"],
-  "mappings": ";AAgFI,SACE,KADF;AA9EJ,YAAY,WAAW;AAEvB,SAAS,WAAW,YAAY,eAAe,mBAAmB;AAClE,SAAS,MAAM,gBAAgB;AAC/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AACnC,SAAS,YAAY;AAEd,MAAM,eAAe;AACrB,MAAM,0BAA0B;AACvC,MAAM,4BAA4B;AAc3B,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAA6B;AAC3B,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAA4C;AAAA,IACrF,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM,UAAU,gBAAgB,EAAE,cAAc,IAAI,CAAC;AACrD,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MACT,eAAe,yBAAyB;AAAA,UACtC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,QAC9B,CAAC;AAAA,QACH,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB;AAAA,MACnB,CAAC;AACD,cAAQ,IAAI;AACZ;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN;AAAA,QACE,EAAE,4CAA4C,oCAAoC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,mBAAmB,aAAa,GAAG,aAAa,CAAC;AAErD,SACE,qBAAC,UAAO,MAAK,UAAS,SAAkB,SAAS,eAAe,UAAU,cAAc,MACtF;AAAA,wBAAC,iBAAc,WAAU,UAAS,eAAY,QAAO;AAAA,IACpD,OAAO,YAAY;AAAA,KACtB;AAEJ;AAcO,SAAS,gBAAgB,EAAE,eAAe,aAAa,aAAa,GAAyB;AAClG,QAAM,IAAI,KAAK;AACf,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,eAAY,WAAU,UAAS,eAAY,QAAO;AAAA,MACzD,OAAO,EAAE,2CAA2C,wCAAwC;AAAA,MAC5F,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE,qBAAC,SAAI,WAAU,oDACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAO,MAC7C,+BAAC,OAAE,MAAM,YACP;AAAA,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA,UAChD,EAAE,0CAA0C,iBAAiB;AAAA,WAChE,GACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,OAAO,EAAE,6CAA6C,gBAAgB;AAAA,YACtE,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,QACxE;AAAA,SACF;AAAA;AAAA,EAEJ,GACF,GACF;AAEJ;AAMO,SAAS,2BAA2B;AACzC,QAAM,IAAI,KAAK;AACf,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,cAAW,WAAU,UAAS,eAAY,QAAO;AAAA,MACxD,OAAO,EAAE,0CAA0C,mCAAmC;AAAA,MACtF,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,OAAO,EAAE,4CAA4C,8BAA8B;AAAA,UACnF,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,MACxE;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,0BAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { ArrowLeft, FolderOpen, MessageSquare, ShieldAlert } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { EmptyState } from '@open-mercato/ui/primitives/empty-state'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useProjectAccessScope } from './projectAccessScope'\nimport type { ResolvedProjectAccessScope } from './projectAccessScopeHeaders'\n\nexport const MY_WORK_HREF = '/backend/staff/time-tracking'\nexport const ACCESS_REQUEST_ENDPOINT = '/api/staff/timesheets/access-requests'\nconst ACCESS_REQUEST_CONTEXT_ID = 'staff.time_tracking.access_request'\n\nexport type AccessRequestButtonProps = {\n  /**\n   * Sent with the request so a Team Leader lands on the right project team\n   * drawer. It is never rendered \u2014 screen 17 note 1 forbids confirming that the\n   * project exists to a user who has no right to it.\n   */\n  timeProjectId?: string | null\n  resolvedScope?: ResolvedProjectAccessScope | null\n  label: string\n  sentLabel: string\n  variant?: 'default' | 'outline'\n}\n\nexport function AccessRequestButton(props: AccessRequestButtonProps) {\n  const { scopeKey, isCurrentScope } = useProjectAccessScope(props.timeProjectId, props.resolvedScope)\n  return <ScopedAccessRequestButton key={scopeKey} {...props} isCurrentScope={isCurrentScope} />\n}\n\nfunction ScopedAccessRequestButton({\n  timeProjectId,\n  label,\n  sentLabel,\n  variant = 'outline',\n  isCurrentScope,\n}: AccessRequestButtonProps & { isCurrentScope: () => boolean }) {\n  const t = useT()\n  const [submitting, setSubmitting] = React.useState(false)\n  const [sent, setSent] = React.useState(false)\n  const mounted = React.useRef(true)\n  React.useEffect(() => {\n    mounted.current = true\n    return () => { mounted.current = false }\n  }, [])\n  const { runMutation, retryLastMutation } = useGuardedMutation<Record<string, unknown>>({\n    contextId: ACCESS_REQUEST_CONTEXT_ID,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const requestAccess = React.useCallback(async () => {\n    const isCurrent = () => mounted.current && isCurrentScope()\n    if (!isCurrent()) return\n    const payload = timeProjectId ? { timeProjectId } : {}\n    setSubmitting(true)\n    try {\n      await runMutation({\n        operation: () => {\n          if (!isCurrent()) throw new Error('[internal] Access request scope changed')\n          return apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify(payload),\n          })\n        },\n        context: {\n          formId: ACCESS_REQUEST_CONTEXT_ID,\n          resourceKind: 'staff.timesheets.access_request',\n          retryLastMutation,\n        },\n        mutationPayload: payload,\n      })\n      if (!isCurrent()) return\n      setSent(true)\n      flash(\n        t(\n          'staff.time_tracking.access.request.success',\n          'Your request has been sent to the Team Leaders.',\n        ),\n        'success',\n      )\n    } catch {\n      if (!isCurrent()) return\n      flash(\n        t('staff.time_tracking.access.request.error', 'Could not send the access request.'),\n        'error',\n      )\n    } finally {\n      if (isCurrent()) setSubmitting(false)\n    }\n  }, [isCurrentScope, retryLastMutation, runMutation, t, timeProjectId])\n\n  return (\n    <Button type=\"button\" variant={variant} onClick={requestAccess} disabled={submitting || sent}>\n      <MessageSquare className=\"size-4\" aria-hidden=\"true\" />\n      {sent ? sentLabel : label}\n    </Button>\n  )\n}\n\nexport type NoProjectAccessProps = {\n  timeProjectId?: string | null\n  resolvedScope?: ResolvedProjectAccessScope | null\n  /** Where the \"Back to My work\" action returns to. */\n  myWorkHref?: string\n}\n\n/**\n * Screen 17 \u2014 a project-scoped route the caller may not open. The copy names\n * neither the customer nor the project (note 1) and covers both \"never had\n * access\" and \"access was revoked\" (note 2); navigation stays untouched because\n * the caller still has other projects (note 3).\n */\nexport function NoProjectAccess({ timeProjectId, resolvedScope, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {\n  const t = useT()\n  return (\n    <Page>\n      <PageBody>\n        <EmptyState\n          variant=\"subtle\"\n          size=\"lg\"\n          icon={<ShieldAlert className=\"size-6\" aria-hidden=\"true\" />}\n          title={t('staff.time_tracking.access.denied.title', 'You do not have access to this project')}\n          description={t(\n            'staff.time_tracking.access.denied.description',\n            'Project access is granted one project at a time by a Team Leader. If you had access before, it may have been revoked \u2014 your earlier time entries stay saved.',\n          )}\n          actions={\n            <div className=\"flex flex-wrap items-center justify-center gap-2\">\n              <Button type=\"button\" variant=\"default\" asChild>\n                <a href={myWorkHref}>\n                  <ArrowLeft className=\"size-4\" aria-hidden=\"true\" />\n                  {t('staff.time_tracking.access.denied.back', 'Back to My work')}\n                </a>\n              </Button>\n              <AccessRequestButton\n                timeProjectId={timeProjectId}\n                resolvedScope={resolvedScope}\n                label={t('staff.time_tracking.access.denied.request', 'Request access')}\n                sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n              />\n            </div>\n          }\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\n/**\n * Screen 2 \u2014 the caller has no project assignments at all. Rendered inside the\n * host page (which keeps its own header), so it stays a bare empty state.\n */\nexport function NoTimeProjectAssignments() {\n  const t = useT()\n  return (\n    <EmptyState\n      variant=\"subtle\"\n      size=\"lg\"\n      icon={<FolderOpen className=\"size-6\" aria-hidden=\"true\" />}\n      title={t('staff.time_tracking.access.empty.title', 'You have no projects assigned yet')}\n      description={t(\n        'staff.time_tracking.access.empty.description',\n        'A Team Leader grants project access. Once you are added to a project it shows up here right away \u2014 no need to log in again.',\n      )}\n      actions={\n        <AccessRequestButton\n          variant=\"default\"\n          label={t('staff.time_tracking.access.empty.request', 'Ask a Team Leader for access')}\n          sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n        />\n      }\n    />\n  )\n}\n\nexport default NoProjectAccess\n"],
+  "mappings": ";AAkCS,cAkEL,YAlEK;AAhCT,YAAY,WAAW;AAEvB,SAAS,WAAW,YAAY,eAAe,mBAAmB;AAClE,SAAS,MAAM,gBAAgB;AAC/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AAG/B,MAAM,eAAe;AACrB,MAAM,0BAA0B;AACvC,MAAM,4BAA4B;AAe3B,SAAS,oBAAoB,OAAiC;AACnE,QAAM,EAAE,UAAU,eAAe,IAAI,sBAAsB,MAAM,eAAe,MAAM,aAAa;AACnG,SAAO,oBAAC,6BAA0C,GAAG,OAAO,kBAArB,QAAqD;AAC9F;AAEA,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV;AACF,GAAiE;AAC/D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,UAAU,MAAM,OAAO,IAAI;AACjC,QAAM,UAAU,MAAM;AACpB,YAAQ,UAAU;AAClB,WAAO,MAAM;AAAE,cAAQ,UAAU;AAAA,IAAM;AAAA,EACzC,GAAG,CAAC,CAAC;AACL,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAA4C;AAAA,IACrF,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM,YAAY,MAAM,QAAQ,WAAW,eAAe;AAC1D,QAAI,CAAC,UAAU,EAAG;AAClB,UAAM,UAAU,gBAAgB,EAAE,cAAc,IAAI,CAAC;AACrD,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MAAM;AACf,cAAI,CAAC,UAAU,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC3E,iBAAO,eAAe,yBAAyB;AAAA,YAC7C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,UAC9B,CAAC;AAAA,QACH;AAAA,QACA,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,CAAC,UAAU,EAAG;AAClB,cAAQ,IAAI;AACZ;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,UAAI,CAAC,UAAU,EAAG;AAClB;AAAA,QACE,EAAE,4CAA4C,oCAAoC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,UAAI,UAAU,EAAG,eAAc,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,gBAAgB,mBAAmB,aAAa,GAAG,aAAa,CAAC;AAErE,SACE,qBAAC,UAAO,MAAK,UAAS,SAAkB,SAAS,eAAe,UAAU,cAAc,MACtF;AAAA,wBAAC,iBAAc,WAAU,UAAS,eAAY,QAAO;AAAA,IACpD,OAAO,YAAY;AAAA,KACtB;AAEJ;AAeO,SAAS,gBAAgB,EAAE,eAAe,eAAe,aAAa,aAAa,GAAyB;AACjH,QAAM,IAAI,KAAK;AACf,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,eAAY,WAAU,UAAS,eAAY,QAAO;AAAA,MACzD,OAAO,EAAE,2CAA2C,wCAAwC;AAAA,MAC5F,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE,qBAAC,SAAI,WAAU,oDACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAO,MAC7C,+BAAC,OAAE,MAAM,YACP;AAAA,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA,UAChD,EAAE,0CAA0C,iBAAiB;AAAA,WAChE,GACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA;AAAA,YACA,OAAO,EAAE,6CAA6C,gBAAgB;AAAA,YACtE,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,QACxE;AAAA,SACF;AAAA;AAAA,EAEJ,GACF,GACF;AAEJ;AAMO,SAAS,2BAA2B;AACzC,QAAM,IAAI,KAAK;AACf,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,cAAW,WAAU,UAAS,eAAY,QAAO;AAAA,MACxD,OAAO,EAAE,0CAA0C,mCAAmC;AAAA,MACtF,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,OAAO,EAAE,4CAA4C,8BAA8B;AAAA,UACnF,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,MACxE;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,0BAAQ;",
   "names": []
 }

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScope.js

@@ -0,0 +1,64 @@
+"use client";
+import * as React from "react";
+import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
+import {
+  parseSelectedOrganizationCookie,
+  parseSelectedTenantCookie
+} from "@open-mercato/core/modules/directory/utils/scopeCookies";
+function readProjectAccessScope(timeProjectId) {
+  const cookieHeader = typeof document === "undefined" ? null : document.cookie;
+  return {
+    projectId: timeProjectId ?? null,
+    tenantId: parseSelectedTenantCookie(cookieHeader),
+    organizationId: parseSelectedOrganizationCookie(cookieHeader)
+  };
+}
+function bindProjectAccessScope(bound, current, resolvedScope) {
+  const continues = (boundValue, currentValue, resolvedValue) => boundValue === currentValue || boundValue === null && currentValue === resolvedValue;
+  if (bound.projectId !== current.projectId) return null;
+  if (!continues(bound.tenantId, current.tenantId, resolvedScope?.tenantId)) return null;
+  if (!continues(bound.organizationId, current.organizationId, resolvedScope?.organizationId)) return null;
+  return current;
+}
+function isSameProjectAccessScope(left, right) {
+  return left.projectId === right.projectId && left.tenantId === right.tenantId && left.organizationId === right.organizationId;
+}
+function rebindProjectAccessScope(binding, current) {
+  const continued = bindProjectAccessScope(binding.scope, current, binding.resolvedScope);
+  if (!continued) return { scope: current, generation: binding.generation + 1, resolvedScope: null };
+  if (isSameProjectAccessScope(continued, binding.scope)) return binding;
+  return { ...binding, scope: continued };
+}
+function useProjectAccessScope(timeProjectId, initialResolvedScope) {
+  useOrganizationScopeVersion();
+  const current = readProjectAccessScope(timeProjectId);
+  const [binding, setBinding] = React.useState(() => ({
+    scope: current,
+    generation: 0,
+    resolvedScope: initialResolvedScope ?? null
+  }));
+  const nextBinding = rebindProjectAccessScope(binding, current);
+  if (nextBinding !== binding) setBinding(nextBinding);
+  const boundScope = React.useRef(nextBinding);
+  boundScope.current = nextBinding;
+  const generation = nextBinding.generation;
+  const isCurrentScope = React.useCallback(() => {
+    const active = boundScope.current;
+    return active.generation === generation && bindProjectAccessScope(active.scope, readProjectAccessScope(timeProjectId), active.resolvedScope) !== null;
+  }, [generation, timeProjectId]);
+  const resolveScope = React.useCallback((resolvedScope) => {
+    setBinding((previous) => {
+      if (previous.generation !== generation) return previous;
+      if (!bindProjectAccessScope(previous.scope, readProjectAccessScope(timeProjectId), resolvedScope)) return previous;
+      const changed = previous.resolvedScope !== null && resolvedScope !== null && (previous.resolvedScope.tenantId !== resolvedScope.tenantId || previous.resolvedScope.organizationId !== resolvedScope.organizationId);
+      return { ...previous, resolvedScope, generation: previous.generation + (changed ? 1 : 0) };
+    });
+  }, [generation, timeProjectId]);
+  return { scopeKey: String(generation), isCurrentScope, resolvedScope: nextBinding.resolvedScope, resolveScope };
+}
+export {
+  bindProjectAccessScope,
+  readProjectAccessScope,
+  useProjectAccessScope
+};
+//# sourceMappingURL=projectAccessScope.js.map

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/projectAccessScope.ts"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport {\n  parseSelectedOrganizationCookie,\n  parseSelectedTenantCookie,\n} from '@open-mercato/core/modules/directory/utils/scopeCookies'\nimport type { ResolvedProjectAccessScope } from './projectAccessScopeHeaders'\n\nexport type ProjectAccessScope = {\n  projectId: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\nexport type ProjectAccessScopeState = {\n  /** Stable while the scope stays the same; changes when the project, tenant or organization changes. */\n  scopeKey: string\n  /** Reads the scope cookies again, so it also catches a change that has not been rendered yet. */\n  isCurrentScope: () => boolean\n  resolvedScope: ResolvedProjectAccessScope | null\n  resolveScope: (scope: ResolvedProjectAccessScope | null) => void\n}\n\ntype ProjectAccessScopeBinding = {\n  scope: ProjectAccessScope\n  generation: number\n  resolvedScope: ResolvedProjectAccessScope | null\n}\n\nexport function readProjectAccessScope(timeProjectId?: string | null): ProjectAccessScope {\n  const cookieHeader = typeof document === 'undefined' ? null : document.cookie\n  return {\n    projectId: timeProjectId ?? null,\n    tenantId: parseSelectedTenantCookie(cookieHeader),\n    organizationId: parseSelectedOrganizationCookie(cookieHeader),\n  }\n}\n\nexport function bindProjectAccessScope(\n  bound: ProjectAccessScope,\n  current: ProjectAccessScope,\n  resolvedScope?: ResolvedProjectAccessScope | null,\n): ProjectAccessScope | null {\n  const continues = (boundValue: string | null, currentValue: string | null, resolvedValue?: string) =>\n    boundValue === currentValue || (boundValue === null && currentValue === resolvedValue)\n  if (bound.projectId !== current.projectId) return null\n  if (!continues(bound.tenantId, current.tenantId, resolvedScope?.tenantId)) return null\n  if (!continues(bound.organizationId, current.organizationId, resolvedScope?.organizationId)) return null\n  return current\n}\n\nfunction isSameProjectAccessScope(left: ProjectAccessScope, right: ProjectAccessScope): boolean {\n  return left.projectId === right.projectId\n    && left.tenantId === right.tenantId\n    && left.organizationId === right.organizationId\n}\n\nfunction rebindProjectAccessScope(\n  binding: ProjectAccessScopeBinding,\n  current: ProjectAccessScope,\n): ProjectAccessScopeBinding {\n  const continued = bindProjectAccessScope(binding.scope, current, binding.resolvedScope)\n  if (!continued) return { scope: current, generation: binding.generation + 1, resolvedScope: null }\n  if (isSameProjectAccessScope(continued, binding.scope)) return binding\n  return { ...binding, scope: continued }\n}\n\nexport function useProjectAccessScope(\n  timeProjectId?: string | null,\n  initialResolvedScope?: ResolvedProjectAccessScope | null,\n): ProjectAccessScopeState {\n  useOrganizationScopeVersion()\n  const current = readProjectAccessScope(timeProjectId)\n  const [binding, setBinding] = React.useState<ProjectAccessScopeBinding>(() => ({\n    scope: current,\n    generation: 0,\n    resolvedScope: initialResolvedScope ?? null,\n  }))\n  const nextBinding = rebindProjectAccessScope(binding, current)\n  if (nextBinding !== binding) setBinding(nextBinding)\n  const boundScope = React.useRef(nextBinding)\n  boundScope.current = nextBinding\n  const generation = nextBinding.generation\n  const isCurrentScope = React.useCallback(() => {\n    const active = boundScope.current\n    return active.generation === generation\n      && bindProjectAccessScope(active.scope, readProjectAccessScope(timeProjectId), active.resolvedScope) !== null\n  }, [generation, timeProjectId])\n  const resolveScope = React.useCallback((resolvedScope: ResolvedProjectAccessScope | null) => {\n    setBinding((previous) => {\n      if (previous.generation !== generation) return previous\n      if (!bindProjectAccessScope(previous.scope, readProjectAccessScope(timeProjectId), resolvedScope)) return previous\n      const changed = previous.resolvedScope !== null && resolvedScope !== null\n        && (previous.resolvedScope.tenantId !== resolvedScope.tenantId\n          || previous.resolvedScope.organizationId !== resolvedScope.organizationId)\n      return { ...previous, resolvedScope, generation: previous.generation + (changed ? 1 : 0) }\n    })\n  }, [generation, timeProjectId])\n  return { scopeKey: String(generation), isCurrentScope, resolvedScope: nextBinding.resolvedScope, resolveScope }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAwBA,SAAS,uBAAuB,eAAmD;AACxF,QAAM,eAAe,OAAO,aAAa,cAAc,OAAO,SAAS;AACvE,SAAO;AAAA,IACL,WAAW,iBAAiB;AAAA,IAC5B,UAAU,0BAA0B,YAAY;AAAA,IAChD,gBAAgB,gCAAgC,YAAY;AAAA,EAC9D;AACF;AAEO,SAAS,uBACd,OACA,SACA,eAC2B;AAC3B,QAAM,YAAY,CAAC,YAA2B,cAA6B,kBACzE,eAAe,gBAAiB,eAAe,QAAQ,iBAAiB;AAC1E,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,CAAC,UAAU,MAAM,UAAU,QAAQ,UAAU,eAAe,QAAQ,EAAG,QAAO;AAClF,MAAI,CAAC,UAAU,MAAM,gBAAgB,QAAQ,gBAAgB,eAAe,cAAc,EAAG,QAAO;AACpG,SAAO;AACT;AAEA,SAAS,yBAAyB,MAA0B,OAAoC;AAC9F,SAAO,KAAK,cAAc,MAAM,aAC3B,KAAK,aAAa,MAAM,YACxB,KAAK,mBAAmB,MAAM;AACrC;AAEA,SAAS,yBACP,SACA,SAC2B;AAC3B,QAAM,YAAY,uBAAuB,QAAQ,OAAO,SAAS,QAAQ,aAAa;AACtF,MAAI,CAAC,UAAW,QAAO,EAAE,OAAO,SAAS,YAAY,QAAQ,aAAa,GAAG,eAAe,KAAK;AACjG,MAAI,yBAAyB,WAAW,QAAQ,KAAK,EAAG,QAAO;AAC/D,SAAO,EAAE,GAAG,SAAS,OAAO,UAAU;AACxC;AAEO,SAAS,sBACd,eACA,sBACyB;AACzB,8BAA4B;AAC5B,QAAM,UAAU,uBAAuB,aAAa;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAoC,OAAO;AAAA,IAC7E,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,eAAe,wBAAwB;AAAA,EACzC,EAAE;AACF,QAAM,cAAc,yBAAyB,SAAS,OAAO;AAC7D,MAAI,gBAAgB,QAAS,YAAW,WAAW;AACnD,QAAM,aAAa,MAAM,OAAO,WAAW;AAC3C,aAAW,UAAU;AACrB,QAAM,aAAa,YAAY;AAC/B,QAAM,iBAAiB,MAAM,YAAY,MAAM;AAC7C,UAAM,SAAS,WAAW;AAC1B,WAAO,OAAO,eAAe,cACxB,uBAAuB,OAAO,OAAO,uBAAuB,aAAa,GAAG,OAAO,aAAa,MAAM;AAAA,EAC7G,GAAG,CAAC,YAAY,aAAa,CAAC;AAC9B,QAAM,eAAe,MAAM,YAAY,CAAC,kBAAqD;AAC3F,eAAW,CAAC,aAAa;AACvB,UAAI,SAAS,eAAe,WAAY,QAAO;AAC/C,UAAI,CAAC,uBAAuB,SAAS,OAAO,uBAAuB,aAAa,GAAG,aAAa,EAAG,QAAO;AAC1G,YAAM,UAAU,SAAS,kBAAkB,QAAQ,kBAAkB,SAC/D,SAAS,cAAc,aAAa,cAAc,YACjD,SAAS,cAAc,mBAAmB,cAAc;AAC/D,aAAO,EAAE,GAAG,UAAU,eAAe,YAAY,SAAS,cAAc,UAAU,IAAI,GAAG;AAAA,IAC3F,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,aAAa,CAAC;AAC9B,SAAO,EAAE,UAAU,OAAO,UAAU,GAAG,gBAAgB,eAAe,YAAY,eAAe,aAAa;AAChH;",
+  "names": []
+}

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.js

@@ -0,0 +1,13 @@
+const PROJECT_SCOPE_TENANT_HEADER = "x-om-project-scope-tenant-id";
+const PROJECT_SCOPE_ORGANIZATION_HEADER = "x-om-project-scope-organization-id";
+function readResolvedProjectAccessScope(response) {
+  const tenantId = response.headers?.get(PROJECT_SCOPE_TENANT_HEADER);
+  const organizationId = response.headers?.get(PROJECT_SCOPE_ORGANIZATION_HEADER);
+  return tenantId && organizationId ? { tenantId, organizationId } : null;
+}
+export {
+  PROJECT_SCOPE_ORGANIZATION_HEADER,
+  PROJECT_SCOPE_TENANT_HEADER,
+  readResolvedProjectAccessScope
+};
+//# sourceMappingURL=projectAccessScopeHeaders.js.map

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.ts"],
+  "sourcesContent": ["export const PROJECT_SCOPE_TENANT_HEADER = 'x-om-project-scope-tenant-id'\nexport const PROJECT_SCOPE_ORGANIZATION_HEADER = 'x-om-project-scope-organization-id'\n\nexport type ResolvedProjectAccessScope = {\n  tenantId: string\n  organizationId: string\n}\n\nexport function readResolvedProjectAccessScope(\n  response: { headers?: Pick<Headers, 'get'> },\n): ResolvedProjectAccessScope | null {\n  const tenantId = response.headers?.get(PROJECT_SCOPE_TENANT_HEADER)\n  const organizationId = response.headers?.get(PROJECT_SCOPE_ORGANIZATION_HEADER)\n  return tenantId && organizationId ? { tenantId, organizationId } : null\n}\n"],
+  "mappings": "AAAO,MAAM,8BAA8B;AACpC,MAAM,oCAAoC;AAO1C,SAAS,+BACd,UACmC;AACnC,QAAM,WAAW,SAAS,SAAS,IAAI,2BAA2B;AAClE,QAAM,iBAAiB,SAAS,SAAS,IAAI,iCAAiC;AAC9E,SAAO,YAAY,iBAAiB,EAAE,UAAU,eAAe,IAAI;AACrE;",
+  "names": []
+}

package/dist/modules/sync_excel/index.js

@@ -1,7 +1,17 @@
 const metadata = {
   id: "sync_excel",
   title: "Excel / CSV Import",
-  description: "File-upload-based CSV import foundation built on top of the data sync hub."
+  description: "File-upload-based CSV import foundation built on top of the data sync hub.",
+  /**
+   * `customers` is a HARD dependency: `lib/adapters/customers.ts` reads `E.customers.*` at module scope.
+   *
+   * `E` only carries a key for an ENABLED module, so with `customers` switched off that read is
+   * `undefined.customer_entity` and it throws while the adapter is being imported — not inside a request, where
+   * it could be traced. Declaring it has the generator refuse the combination before anybody starts the app.
+   *
+   * `data_sync` is the hub this is built on, named in the description and now in the manifest too.
+   */
+  requires: ["customers", "data_sync"]
 };
 var sync_excel_default = metadata;
 export {

package/dist/modules/sync_excel/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/sync_excel/index.ts"],
-  "sourcesContent": ["export const metadata = {\n  id: 'sync_excel',\n  title: 'Excel / CSV Import',\n  description: 'File-upload-based CSV import foundation built on top of the data sync hub.',\n}\n\nexport default metadata\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,aAAa;AACf;AAEA,IAAO,qBAAQ;",
+  "sourcesContent": ["export const metadata = {\n  id: 'sync_excel',\n  title: 'Excel / CSV Import',\n  description: 'File-upload-based CSV import foundation built on top of the data sync hub.',\n  /**\n   * `customers` is a HARD dependency: `lib/adapters/customers.ts` reads `E.customers.*` at module scope.\n   *\n   * `E` only carries a key for an ENABLED module, so with `customers` switched off that read is\n   * `undefined.customer_entity` and it throws while the adapter is being imported \u2014 not inside a request, where\n   * it could be traced. Declaring it has the generator refuse the combination before anybody starts the app.\n   *\n   * `data_sync` is the hub this is built on, named in the description and now in the manifest too.\n   */\n  requires: ['customers', 'data_sync'],\n}\n\nexport default metadata\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUb,UAAU,CAAC,aAAa,WAAW;AACrC;AAEA,IAAO,qBAAQ;",
   "names": []
 }

package/dist/modules/translations/di.js

@@ -2,6 +2,7 @@ import { registerTranslatableFields } from "@open-mercato/shared/lib/localizatio
 import { registerTranslationOverlayPlugin } from "@open-mercato/shared/lib/localization/overlay-plugin";
 import { registerSupportedLocalesResolver } from "@open-mercato/shared/lib/i18n/locale-registry";
 import { translatableFields as catalogFields } from "../catalog/translations.js";
+import { translatableFields as customerFields } from "../customers/translations.js";
 import { translatableFields as dictionaryFields } from "../dictionaries/translations.js";
 import { translatableFields as entitiesFields } from "../entities/translations.js";
 import { translatableFields as resourcesFields } from "../resources/translations.js";
@@ -11,6 +12,7 @@ import { resolveTenantSupportedLocales } from "./lib/supported-locales.js";
 registerSupportedLocalesResolver(resolveTenantSupportedLocales);
 function register() {
   registerTranslatableFields(catalogFields);
+  registerTranslatableFields(customerFields);
   registerTranslatableFields(dictionaryFields);
   registerTranslatableFields(entitiesFields);
   registerTranslatableFields(resourcesFields);

package/dist/modules/translations/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/translations/di.ts"],
-  "sourcesContent": ["import { registerTranslatableFields } from '@open-mercato/shared/lib/localization/translatable-fields'\nimport { registerTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'\nimport { registerSupportedLocalesResolver } from '@open-mercato/shared/lib/i18n/locale-registry'\nimport { translatableFields as catalogFields } from '../catalog/translations'\nimport { translatableFields as dictionaryFields } from '../dictionaries/translations'\nimport { translatableFields as entitiesFields } from '../entities/translations'\nimport { translatableFields as resourcesFields } from '../resources/translations'\nimport { applyTranslationOverlays } from './lib/apply'\nimport { resolveLocaleFromRequest } from './lib/locale'\nimport { resolveTenantSupportedLocales } from './lib/supported-locales'\n\n// Registered at module scope, not inside `register()`: module DI registrars only\n// run when the first request container is built, and the root layout resolves the\n// served locale set without ever building one. Inside `register()` the very first\n// render of a fresh process would find an empty resolver slot and serve the\n// un-narrowed set. `di.generated.ts` imports this module statically from the app\n// bootstrap, so the slot is filled at import time instead.\nregisterSupportedLocalesResolver(resolveTenantSupportedLocales)\n\nexport function register() {\n  registerTranslatableFields(catalogFields)\n  registerTranslatableFields(dictionaryFields)\n  registerTranslatableFields(entitiesFields)\n  registerTranslatableFields(resourcesFields)\n  registerTranslationOverlayPlugin(applyTranslationOverlays, resolveLocaleFromRequest)\n}\n"],
-  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,wCAAwC;AACjD,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,qBAAqB;AACpD,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,uBAAuB;AACtD,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AACzC,SAAS,qCAAqC;AAQ9C,iCAAiC,6BAA6B;AAEvD,SAAS,WAAW;AACzB,6BAA2B,aAAa;AACxC,6BAA2B,gBAAgB;AAC3C,6BAA2B,cAAc;AACzC,6BAA2B,eAAe;AAC1C,mCAAiC,0BAA0B,wBAAwB;AACrF;",
+  "sourcesContent": ["import { registerTranslatableFields } from '@open-mercato/shared/lib/localization/translatable-fields'\nimport { registerTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'\nimport { registerSupportedLocalesResolver } from '@open-mercato/shared/lib/i18n/locale-registry'\nimport { translatableFields as catalogFields } from '../catalog/translations'\nimport { translatableFields as customerFields } from '../customers/translations'\nimport { translatableFields as dictionaryFields } from '../dictionaries/translations'\nimport { translatableFields as entitiesFields } from '../entities/translations'\nimport { translatableFields as resourcesFields } from '../resources/translations'\nimport { applyTranslationOverlays } from './lib/apply'\nimport { resolveLocaleFromRequest } from './lib/locale'\nimport { resolveTenantSupportedLocales } from './lib/supported-locales'\n\n// Registered at module scope, not inside `register()`: module DI registrars only\n// run when the first request container is built, and the root layout resolves the\n// served locale set without ever building one. Inside `register()` the very first\n// render of a fresh process would find an empty resolver slot and serve the\n// un-narrowed set. `di.generated.ts` imports this module statically from the app\n// bootstrap, so the slot is filled at import time instead.\nregisterSupportedLocalesResolver(resolveTenantSupportedLocales)\n\nexport function register() {\n  registerTranslatableFields(catalogFields)\n  registerTranslatableFields(customerFields)\n  registerTranslatableFields(dictionaryFields)\n  registerTranslatableFields(entitiesFields)\n  registerTranslatableFields(resourcesFields)\n  registerTranslationOverlayPlugin(applyTranslationOverlays, resolveLocaleFromRequest)\n}\n"],
+  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,wCAAwC;AACjD,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,qBAAqB;AACpD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,uBAAuB;AACtD,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AACzC,SAAS,qCAAqC;AAQ9C,iCAAiC,6BAA6B;AAEvD,SAAS,WAAW;AACzB,6BAA2B,aAAa;AACxC,6BAA2B,cAAc;AACzC,6BAA2B,gBAAgB;AAC3C,6BAA2B,cAAc;AACzC,6BAA2B,eAAe;AAC1C,mCAAiC,0BAA0B,wBAAwB;AACrF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7833.1.d6cbf0e3ab",
+  "version": "0.10.1-develop.7841.1.af87ac614d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.6.6"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7833.1.d6cbf0e3ab",
-    "@open-mercato/shared": "0.10.1-develop.7833.1.d6cbf0e3ab",
-    "@open-mercato/ui": "0.10.1-develop.7833.1.d6cbf0e3ab",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7833.1.d6cbf0e3ab",
-    "@open-mercato/shared": "0.10.1-develop.7833.1.d6cbf0e3ab",
-    "@open-mercato/ui": "0.10.1-develop.7833.1.d6cbf0e3ab",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/cart/api/current/lines/bulk/route.ts

@@ -184,7 +184,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 409, description: 'Optimistic-lock conflict' },
         { status: 422, description: 'Idempotency key mismatch' },
         { status: 429, description: 'Rate limited' },
-        { status: 503, description: 'No store context resolvable for this request (§6a.1a)' },
+        { status: 503, description: 'No store context resolvable, or cart_busy after 15 seconds waiting for the line lock. The requested line add/bulk-add phases did not run; earlier activity/context/repricing may have persisted. Retry the same request after Retry-After: 1 second, preserving Idempotency-Key.' },
       ],
     },
   },

package/src/modules/cart/api/current/lines/route.ts

@@ -201,7 +201,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 409, description: 'Optimistic-lock conflict, or the cart is a `proposal` cart' },
         { status: 422, description: 'Quantity rule violation, idempotency key mismatch, or an unpriceable product' },
         { status: 429, description: 'Rate limited' },
-        { status: 503, description: 'No store context resolvable for this request (§6a.1a)' },
+        { status: 503, description: 'No store context resolvable, or cart_busy after 15 seconds waiting for the line lock. The requested line add/bulk-add phases did not run; earlier activity/context/repricing may have persisted. Retry the same request after Retry-After: 1 second, preserving Idempotency-Key.' },
       ],
     },
   },

package/src/modules/cart/commands/lines.ts

@@ -57,6 +57,7 @@ import {
 } from '../lib/visibility'
 import type { CartVisibilityLineRef, ResolvedAssortmentScope } from '../lib/visibility'
 import { shouldEnforceAssortmentScope } from '../lib/routeContext'
+import { withCartLineMutationLock } from '../lib/lineMutationLock'
 import type { ResolvedCartRouteContext } from '../lib/routeContext'
 import { buildRecomputeCartTotalsPhase } from '../lib/reprice'
 import type { CartPriceChange } from '../lib/reprice'
@@ -938,10 +939,7 @@ const addLineCommand: CommandHandler<CartLinesAddInput, CartLinesAddOutcome> = {
     // `cart.lines.add`/`.bulkAdd` call against this cart instead, closing the race
     // `TC-CART-CONC-05` reproduced (a silently lost update, and a raw 500 off
     // `cart_lines_unique_line_key`).
-    await withAtomicFlush(em, [
-      async () => {
-        await em.execute('select pg_advisory_xact_lock(hashtextextended(?::text, 0))', [`cart:lines:${cart.id}`])
-      },
+    await withCartLineMutationLock(em, cart.id, [
       async () => {
         const existing = await findExistingCustomerLine(em, scope, cart.id, input.productId, variantId, input.configuration ?? null)
         const pricingContext = buildCartPricingRowFilterContext(cart)
@@ -1049,7 +1047,7 @@ const addLineCommand: CommandHandler<CartLinesAddInput, CartLinesAddOutcome> = {
         if (!shouldRecompute()) return
         await phase()
       }),
-    ], { transaction: true, label: 'cart.lines.add' })
+    ], 'cart.lines.add')
 
     if (!outcome) throw new Error('[internal] cart.lines.add produced no outcome')
     // Captured into plain `const`s (never reassigned themselves) rather than read directly
@@ -1641,10 +1639,7 @@ const bulkAddLinesCommand: CommandHandler<CartLinesBulkAddInput, CartLinesBulkAd
     // decision is read-decide-write against rows that may not exist yet, so two concurrent
     // `bulkAdd`/`add` calls on this cart must serialize, not just this call's own entries
     // against each other.
-    await withAtomicFlush(em, [
-      async () => {
-        await em.execute('select pg_advisory_xact_lock(hashtextextended(?::text, 0))', [`cart:lines:${cart.id}`])
-      },
+    await withCartLineMutationLock(em, cart.id, [
       ...phases,
       ...buildCartPromotionsAndTotalsPhases({
         em,
@@ -1657,7 +1652,7 @@ const bulkAddLinesCommand: CommandHandler<CartLinesBulkAddInput, CartLinesBulkAd
         removedGiftLines,
         promotionWarnings,
       }),
-    ], { transaction: true, label: 'cart.lines.bulkAdd' })
+    ], 'cart.lines.bulkAdd')
     await emitVisibilityRejectedEvent(cart, visibilityRejectedCount, 'lines.bulkAdd')
 
     const dataEngine = ctx.container.resolve('dataEngine') as DataEngine

package/src/modules/cart/i18n/de.json

@@ -4,6 +4,7 @@
   "cart.audit.lines.bulkAdd": "Add cart lines (bulk)",
   "cart.audit.lines.remove": "Remove cart line",
   "cart.audit.merge": "Merge cart",
+  "cart.errors.busy": "Der Warenkorb ist ausgelastet. Bitte versuche es erneut.",
   "cart.errors.store_context_unavailable": "Cart is unavailable for this store right now",
   "cart.errors.unexpected": "Unexpected error",
   "cart.warnings.code_no_longer_valid": "A previously applied code is no longer valid",

package/src/modules/cart/i18n/en.json

@@ -4,6 +4,7 @@
   "cart.audit.lines.bulkAdd": "Add cart lines (bulk)",
   "cart.audit.lines.remove": "Remove cart line",
   "cart.audit.merge": "Merge cart",
+  "cart.errors.busy": "Cart is busy. Please try again.",
   "cart.errors.store_context_unavailable": "Cart is unavailable for this store right now",
   "cart.errors.unexpected": "Unexpected error",
   "cart.warnings.code_no_longer_valid": "A previously applied code is no longer valid",

package/src/modules/cart/i18n/es.json

@@ -4,6 +4,7 @@
   "cart.audit.lines.bulkAdd": "Add cart lines (bulk)",
   "cart.audit.lines.remove": "Remove cart line",
   "cart.audit.merge": "Merge cart",
+  "cart.errors.busy": "El carrito está ocupado. Inténtalo de nuevo.",
   "cart.errors.store_context_unavailable": "Cart is unavailable for this store right now",
   "cart.errors.unexpected": "Unexpected error",
   "cart.warnings.code_no_longer_valid": "A previously applied code is no longer valid",

package/src/modules/cart/i18n/ko.json

@@ -4,6 +4,7 @@
   "cart.audit.lines.bulkAdd": "Add cart lines (bulk)",
   "cart.audit.lines.remove": "Remove cart line",
   "cart.audit.merge": "Merge cart",
+  "cart.errors.busy": "장바구니가 사용 중입니다. 다시 시도해 주세요.",
   "cart.errors.store_context_unavailable": "Cart is unavailable for this store right now",
   "cart.errors.unexpected": "Unexpected error",
   "cart.warnings.code_no_longer_valid": "A previously applied code is no longer valid",

package/src/modules/cart/i18n/pl.json

@@ -4,6 +4,7 @@
   "cart.audit.lines.bulkAdd": "Add cart lines (bulk)",
   "cart.audit.lines.remove": "Remove cart line",
   "cart.audit.merge": "Merge cart",
+  "cart.errors.busy": "Koszyk jest zajęty. Spróbuj ponownie.",
   "cart.errors.store_context_unavailable": "Cart is unavailable for this store right now",
   "cart.errors.unexpected": "Unexpected error",
   "cart.warnings.code_no_longer_valid": "A previously applied code is no longer valid",

package/src/modules/cart/lib/currentCartRoute.ts

@@ -10,6 +10,7 @@ import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { getCartCommand } from '../commands/cart'
 import type { CartGetByTokenInput, CartSummary } from '../commands/cart'
 import type { CartPriceChange } from './reprice'
+import { isCartLineMutationLockTimeoutError } from './lineMutationLock'
 import { isCartStoreContextUnavailableError, resolveCartRouteContext } from './routeContext'
 import type { ResolveCartRouteContextOptions, ResolvedCartRouteContext } from './routeContext'
 
@@ -173,6 +174,13 @@ const logger = createLogger('cart').child({ component: 'api' })
  * unexpected 500, logged and reported.
  */
 export async function mapRouteErrorToResponse(error: unknown): Promise<NextResponse> {
+  if (isCartLineMutationLockTimeoutError(error)) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      { error: translate('cart.errors.busy', 'Cart is busy. Please try again.'), code: 'cart_busy' },
+      { status: 503, headers: { 'Retry-After': '1', 'Cache-Control': 'no-store' } },
+    )
+  }
   if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
   const interceptorRejection = getCommandInterceptorHttpRejection(error)
   if (interceptorRejection) return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })

package/src/modules/cart/lib/lineMutationLock.ts

@@ -0,0 +1,59 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { calculateBackoffDelayMs } from '@open-mercato/shared/lib/delivery/retry'
+
+const CART_LINE_LOCK_TIMEOUT = Symbol.for('@open-mercato/cart:LineMutationLockTimeout')
+
+export class CartLineMutationLockTimeoutError extends Error {
+  readonly [CART_LINE_LOCK_TIMEOUT] = true
+
+  constructor() {
+    super('[internal] Cart line mutation lock wait deadline exceeded')
+    this.name = 'CartLineMutationLockTimeoutError'
+  }
+}
+
+export function isCartLineMutationLockTimeoutError(error: unknown): error is CartLineMutationLockTimeoutError {
+  return typeof error === 'object' && error !== null && Reflect.get(error, CART_LINE_LOCK_TIMEOUT) === true
+}
+
+export async function withCartLineMutationLock(
+  em: EntityManager,
+  cartId: string,
+  phases: Array<() => void | Promise<void>>,
+  label: string,
+  waitDeadlineMs = 15_000,
+): Promise<void> {
+  const key = `cart:lines:${cartId}`
+  const deadline = Date.now() + waitDeadlineMs
+  const busy = new Error('[internal] Cart line mutation lock is busy')
+  const joinsTransaction = em.isInTransaction()
+
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await withAtomicFlush(em, [
+        async () => {
+          if (joinsTransaction) {
+            await em.execute('select pg_advisory_xact_lock(hashtextextended(?::text, 0))', [key])
+            return
+          }
+          const rows = await em.execute<Array<{ locked: boolean }>>(
+            'select pg_try_advisory_xact_lock(hashtextextended(?::text, 0)) as locked',
+            [key],
+          )
+          if (!rows[0]?.locked) throw busy
+        },
+        ...phases,
+      ], { transaction: true, label })
+      return
+    } catch (error) {
+      if (error !== busy || em.isInTransaction()) throw error
+    }
+
+    const remainingMs = deadline - Date.now()
+    if (remainingMs <= 0) throw new CartLineMutationLockTimeoutError()
+    const delayMs = calculateBackoffDelayMs(Math.min(attempt, 5), { baseDelayMs: 50, maxJitterMs: 25 })
+    await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)))
+    if (Date.now() >= deadline) throw new CartLineMutationLockTimeoutError()
+  }
+}